Blockchain and Node.js abused by Tsundere: an emerging botnet

According to Securelist, the Tsundere botnet is a Node.js-based threat that uses the Ethereum blockchain to host its command-and-control details, including a wallet and a contract address. The researchers note two fixed on-chain references: Wallet 0x73625B6cdFECC81A4899D221C732E1f73e504a32 and Contract 0xa1b40044EBc2794f207D45143Bd82a1B86156c6b, with a 32‑byte state variable storing a 24‑byte string that decodes to a WebSocket C2 server address such as ws://185.28.119[.]179:1234.

They describe how the bot retrieves the C2 address by querying multiple RPC providers for transactions linked to the contract and wallet, then verifies the URL starts with ws:// or wss:// before connecting. An August 19, 2025 transaction is highlighted as the moment the contract was updated to point to a new C2 address, with other listed endpoints and ports also appearing in the researchers’ data.

The article details infection methods including MSI and PowerShell installers, and notes the bot’s ability to execute dynamic JavaScript commands received from the C2, all under a broader infrastructure that includes a marketplace and a panel named Tsundere Netto.